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CLAIMS 

1 . A method for the protected management of a 
unit counter \ in an electrically erasable and 
programmable memory, according to which the number of 
units consumed by users is recorded by means of a 
counter, characterised in that it consists in breaking 
down the unit counuer into at least two memory areas 
(A, B) , a first area (A) in which at least one bit is 
stored per at least one consumed unit and a second area 
(B) in which the value corresponding to the total units 
consumed is stored, the second area being updated only 
when the number of units consumed exceeds or attains 
the number of not stored\ bits of the first area (A) . 

2 . A method of managing a counter according to 
Claim 1, characterised in that the units consumed are 
recorded in the first areaUA) cyclically. 

3 . A management met mod according to Claims 1 and 
2, characterised in that an operation of recording n 
units consumed comprises the\ following steps: 

- reading the content \of the first area (A) and 
comparing the number of not\ stored bits (L) in the 
first area (A) with the numben of consumed units (n) to 
be recorded, \ 

- if this number of not stored bits (L) is greater 
than or equal to the number \of units (n) to be 
recorded, the bits (n) to be recorded are stored in the 
said first area (A) , \ 

- if this number (L) is less, L bits are stored in 
the first area (A) and the (n-L) remaining units are 
recorded in the second area (B) r>y performing an 
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operation of updating this area, and the first area (A) 
is erased. 

4 . \ A management method according to any one of 
Claims 1 ftp 4 , characterised in that an operation of 
updating the second area (B) comprises a step of 
writing in this second area a new coded counter value 
equal to the \ current value to which the number of 
stored bits in the first area (A) and the (n- 
L) remaining consumed units to be stored are added. 

5. A management method according to Claim 4, 
characterised in ohat the updating comprises a prior 
step of recording indicator information (C2) signifying 
that an updating is currently being carried out. 

6 . A management method according to any one of 
the preceding claims, Characterised in that the unit 
counter has an area (SB) \ for backing up the second area 
(B) and in that these two areas each have a field for 
recording a redundancy cods (CR, SCR) , for checking the 
integrity of the content of these two areas. 

7 . A management method according to Claims 4 and 
5, characterised in that an operation of recording n 
units consumed also comprises a\prior step of verifying 
the state of the counter comprising the following 
operations : 

verifying the absence \of the indicator 
information for a current update: 

where the indicator information is indeed 

absent : 

- verification of the validity\ of the fields 
containing the redundancy codes : 
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where the fields are valid: 
v - recording of the n units; 

lere the fields are not valid: 
letection of a fault and stoppage of the 
counter, 

- where tha indicator information is present: 
- activatrpn of the recovery operation to re- 
establish the integraNty of the contents of the counter. 

8 . A management^ method according to Claims 6 and 
7, characterised in th&t an operation of updating the 
second area (B) then includes the following steps: 

- recording the indicator information (C2) , 

copying, in the backup area (SB) , the coded 
value (VO) of the counter of\the second area (B) , 

- recording the new coo^d value of the counter in 
the second area (B) , 

- erasing the indicator information (C2) 

9. A management method \according to Claim 8, 
characterised in that the recovery operation consists 
in determining at which step the abnormality occurred, 
and then performing, according tov the circumstances 
determined, the steps of updating th«s backup area (SB) 
and/or of the second area (B) and/or \f the first area 
(A) . 

10. A management method accordirfg to Claim 9, 
characterised in that the determination ofi the step at 
which the abnormality occurred consists in\reading the 
content of each of the areas in order to\ determine 
whether the abnormality occurred during the updating of 
the backup area (SB), case 1, during the updating of 
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the second area v (B) , case 2, during the erasure of the 
first area (A), case 3, between the updating of the 
second araa (B) and the backup area (SB), case 4, or 
after the updating of these two areas, case 5, 
in case 1 in: 

- copying the value contained in the second area 
(B) into the backup area (SB) , 

- updating the second area (B) by recording the 
new value which \s equal to the old one to which the 
content of the firfet area (A) is added, 

- erasing the\f irst area (A) , 

- erasing the \ndicator information (C2) ; 
. in case 2 in; 

copying into \the second area (B) the value 
contained in the backup* area ( SB) by adding the value 
contained in the first aiea (A) , 

- erasing the first \area (A), 
erasing the indicator information (C2) ; 
in case 3 in: 

erasing the content h>f the first area (A) , 



- erasing the indicator\inf ormation (C2); 
. in case 4 in: 

- implementing the steps According to case 2; 
. in case 5 in: 

- implementing the steps according to case 3 . 
11. A management method according to any one of 

the preceding claims, characterised in that it 
comprises the step of recording information signifying 
a failure (CI) in reading or writing\to the first area 
(A) deactivating the said area when \it has not been 



possible to read write in this area, and a step of 

reading this information at each new cycle, the units 
consumed then being oirectly recorded in a coded manner 
by an operation of updating the second area (B) . 

12 . A management n^thod according to Claim 5 and 
Claim 11, characterised ih that the information (C2) 
indicating a current updating and the information 
signifying a failure (CI) in rVading and writing to the 
first area are recorded in a thib^d area (C) of the said 
counter . 

13. A security module (SM) implementing the 
method according to any one oi^ the preceding claims . 

14. A security modu^fe\\according to Claim 13, 
characterised in that it is ^stalled in a terminal 
managing the consumed units, \ notably a telephony 
terminal 




